- Company Name
- CFA Institute
- Job Title
- Senior Manager Third-Party Cybersecurity Risk
- Job Description
-
Job title: Senior Manager, Third‑Party Cybersecurity Risk
Role Summary: Lead the design, implementation, and continuous improvement of a third‑party cybersecurity risk management program across the entire vendor lifecycle, integrating security requirements into procurement, contracting, and onboarding while ensuring compliance with applicable regulations and standards.
Expactations: Deliver measurable risk reductions, maintain regulatory and industry standard compliance, provide executive‑level risk dashboards, and act as the primary cyber risk liaison across the organization.
Key Responsibilities:
- Design, implement, and mature the TPRM program across all vendor stages.
- Conduct due diligence, risk assessments, and establish risk ratings, KRIs, and escalation protocols.
- Embed security requirements into sourcing, contracting, and onboarding in partnership with procurement and legal.
- Recommend, track, and close remediation actions; implement continuous monitoring for critical suppliers.
- Build dashboards and metrics to communicate exposure and support leadership decision‑making.
- Align the program with GDPR, CCPA, NIST CSF, ISO 27001, SOC 2, and other frameworks; support internal and external audits.
- Serve as the primary point of contact for third‑party cyber risk, educate stakeholders, and champion best practices.
Required Skills:
- 5–8 years of cybersecurity or vendor risk management experience with direct ownership of third‑party risk.
- Strong knowledge of NIST CSF, ISO 27001, and risk assessment methodologies.
- Familiarity with SOC 2, HIPAA, PCI DSS, and other compliance frameworks.
- Excellent stakeholder management, influence, and communication abilities.
- Analytical, detail‑oriented, and adept at balancing risk with business objectives.
- Experience developing KRIs, dashboards, and continuous monitoring for supplier risk.
Required Education & Certifications:
- Bachelor’s degree in cybersecurity, information systems, risk management, or related field (or equivalent experience).
- Professional certifications preferred: CISM, CRISC, or CTPRP (or equivalent).
Charlottesville, United states
Hybrid
Senior
23-11-2025